As mentioned in the previous blog post, let’s explore how automation works in my lab environment. Describing the process in detail is somewhat challenging, so I may record a video later to demonstrate it more effectively.
Here is the map of my lab, where I will demonstrate the Fabric Attach capability on the switches L1-D1-1 and X460-G2-Fabric-2.
To recap, in a fabric environment, we need to associate services (L2VSN or L3VSN) with an identifier called I-SID. I will create VLAN 999 on X460-G2-Fabric-2 and automatically notify switch L1-D1-1. Let’s check the I-SIDs on L1-D1-1 by issuing the show i-sid command. As highlighted in the output, there is no customer VLAN 999 currently associated.
Next, I’ll create VLAN 999 on X460-G2-Fabric-2 and map it to an I-SID.
After running the show i-sid command again on L1-D1-1, you can see that customer VLAN 999 is now visible and mapped to I-SID 120999.
To verify that this was automatically configured by Fabric Attach, use the show fa assignment command:
Additionally, running the show fabric attach assignment command on the EXOS switch confirms the configuration.
As shown above, using the command configure vlan v999 add nsi 120999, we notify the fabric switch to create the L2VSN. This information is then automatically propagated through the fabric using the ISIS protocol.
The example above involves some manual configuration. How can we automate this process with no configuration on the access switch? We can use a NAC (Network Access Control) solution. In my lab, I’m using Extreme Control, but generally, it can be any NAC, including even Windows NPS or Freeradius. During the authorization process, we can send information to the switch about the I-SID to VLAN mapping. Here’s an example of an authorized end host:
Using Fabric Attach, the access switch will automatically create the VLAN on the access port, the uplink port, and notify the fabric to map VLAN 11 to I-SID 120011.
It’s simple and elegant. Essentially, we can forget about manually creating and assigning VLANs in our infrastructure; everything can be automated. When the solution is complete, meaning both switches and a NAC solution are in place, creating VLANs becomes just a matter of configuring NAC rules—nothing needs to be done on the switches.